The invention relates to systems and methods for protecting computer systems from malware, and in particular to anti-malware systems employing hardware virtualization technology.
Malicious software, also known as malware, affects a great number of computer systems worldwide. In its many forms such as computer viruses, worms, and rootkits, malware presents a serious risk to millions of computer users, making them vulnerable to loss of data and sensitive information, identity theft, and loss of productivity, among others.
Hardware virtualization technology allows the creation of simulated computer environments commonly known as virtual machines, which behave in many ways as physical computer systems. In typical applications such as server consolidation and infrastructure-as-a-service (IAAS), several virtual machines may run simultaneously on the same physical machine, sharing the hardware resources among them, thus reducing investment and operating costs. Each virtual machine may run its own operating system and/or software applications, separately from other virtual machines. Due to the steady proliferation of malware, each virtual machine operating in such an environment potentially requires malware protection.
A virtualization solution commonly used in the art comprises a hypervisor, also known as a virtual machine monitor, consisting of a layer of software operating between the computing hardware and the operating system (OS) of a virtual machine, and having more processor privileges than the respective OS. Since some malware, such as rootkits, operate at OS privilege level, there is interest in developing anti-malware solutions executing at the privilege level of the hypervisor.